4.14.6 Release notes - 1 July 2026

#35648 Removed unused SSL/TLS transport option from the cluster.

#35982 Updated the cryptography, urllib3, and python-multipart Python dependencies.

#36467 Updated eBPF libraries: libbpf to version 1.7.0 and bpftool to version 7.7.0.

#35773 Improved message decompression handling in remoted.

#35833 Improved agent name validation to reject names starting with a dot.

#36011 Fixed segmentation fault in the Vulnerability Scanner module shutdown when disabled.

#36059 Fixed string buffer handling in the version comparison function.

#36060 Improved cluster file synchronization security.

#36129 Improved cluster file synchronization error handling for invalid task identifiers.

#36204 Improved cluster merged file parameter validation to prevent directory escape.

#36246 Improved tmp_file path validation in cluster DAPI.

#36296 Improved cluster non-merged file path validation during worker file processing.

#36460 Improved cluster node name format validation in the hello handler.

#35475 Fixed missing agent.host.ip field in inventory documents when the agent IP is empty.

#6726 Fixed stale agent synced status after hot reload on cluster worker nodes.

#35727 Fixed agent registration not running after reinstalling the agent with apt-get remove.

#35431 Fixed MS-Graph integration handling for relationships containing /.

#35380 Fixed macOS Syscollector to skip package receipts whose payload is no longer installed.

#35838 Fixed missing eBPF create, modify, and delete events on Ubuntu 24 and 26, and improved FIM whodata health check.

#36399 Hardened FIM database path lookups by migrating to parameterized SQL queries.

#35866 Escaped control characters in API usernames in access logs.

#35757 Added input validation in cluster result handling and authentication.

#35442 Fixed current user resolution in the update-user endpoint to enforce admin protection.

#35927 Updated Rootcheck trojan signatures to avoid false positives on modern distributions, including Debian 13, Ubuntu 26, and Arch Linux.

#36782 Fixed wazuh-manager startup failure on RHEL 10 by removing the libcrypt dependency from the embedded Python interpreter.

#8447 Fixed the message displayed when the server cluster is disabled and accessing the Cluster app.

#8464 Fixed authorization for agent removal, group editing, upgrading, and upgrade task details by delegating RBAC enforcement to the API instead of the UI, and avoiding duplicated permission error toasts in upgrade task queries.

#8522 #8555 Fixed deployment and start commands being displayed in the agent registration flow when the user lacks manager:update_config or cluster:update_config permissions required to read the registration password.

wazuh/wazuh

wazuh/wazuh-dashboard-plugins

wazuh/wazuh-ansible

wazuh/wazuh-kubernetes

wazuh/wazuh-puppet

wazuh/wazuh-docker

wazuh/qa-integration-framework

wazuh/wazuh-documentation